BunkerWeb CVE-2026-61718

Exploitation requires a valid BunkerWeb web UI account with at minimum the reader (non-admin) role - unauthenticated access is not sufficient, as Flask's @login_required decorator remains enforced. The specific vulnerable operation is POST /cache/delete (and potentially other write-method routes under /cache/), which bypassed Biscuit role checks in versions 1.6.2-1.6.11. The web UI must be enabled and accessible to the attacker over the network. Exploitation is limited by: (1) requirement for an authenticated low-privilege UI account, meaning the attacker must have legitimate or stolen credentials; (2) no confidentiality impact - the flaw enables deletion, not exfiltration, of cache data; and (3) no code execution or privilege escalation beyond cache manipulation. Deployments where all UI accounts hold admin roles are not exposed to privilege abuse from this specific flaw, though any UI credential compromise still permits exploitation.

The CVSS 3.1 score of 5.4 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L is well-calibrated to the actual impact: network-accessible, low complexity, requiring low-privilege authentication, with limited integrity and availability impact but no confidentiality breach or scope change. No EPSS score was provided in the input data, so exploitation probability cannot be quantified from that signal. The vulnerability is not listed in CISA KEV and no public proof-of-concept exploit is identified, confirming no known active exploitation at time of analysis. Real-world risk is meaningful but bounded: an attacker who can obtain a reader-role UI account can degrade WAF effectiveness by purging job caches, potentially enabling follow-on attacks that the WAF would otherwise block (e.g., removing CrowdSec or DNSBL blacklists). However, exploitation is gated on authenticated low-privilege access - deployments with only admin-role UI accounts are not exposed to privilege escalation, though credential compromise of any UI user remains a vector. This is a genuine medium-priority finding for multi-user BunkerWeb deployments, with urgency scaling proportionally to how many reader-role accounts are provisioned and how critical WAF cache data is to the protected environment.

An attacker who has obtained a valid BunkerWeb reader-role UI credential (via phishing, credential stuffing, or insider access) authenticates to the web interface and issues a standard POST /cache/delete HTTP request. Because BiscuitMiddleware exempts all /cache/ paths from role evaluation, the request is processed without any write-privilege check and the targeted job cache files are permanently deleted. With blacklists, GeoIP databases, and ModSecurity CRS rules purged, the attacker may then proceed with a separate attack against services protected by the now-degraded WAF. No public proof-of-concept is known at time of analysis.